POWERED BY MOMENTUM MEDIA
Email security lapses widespread among super funds
Earlier this month, several Australian superannuation funds fell victim to credential stuffing attacks, which saw a small number of members lose more than $500,000.
Sadly, it appears many such funds are still prone to compromise.
Cyber security firm Proofpoint has released new research into the email security of Australian super funds and the most alarming statistic is that 58 per cent of funds are falling behind on the most basic security measures.
“Australian superannuation funds hold the financial futures of millions of everyday Australians, yet our research reveals 58 per cent are failing to implement basic email security protocols,” said Steve Moros, senior director, advanced technology group, Asia Pacific and Japan at Proofpoint.
“This security gap creates a dangerous opening for cyber criminals who specifically target these data-rich organisations.”
Proofpoint conducted Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of more than 80 Australian funds and found that 8 per cent don’t have any DMARC protection at all, while only 42 per cent have the highest level of DMARC protection.
DMARC has three levels of protection – monitor, quarantine, and reject, the latter of which is the highest level of protection. The protocol is designed to prevent domain names from being misused by cyber criminals.
According to the research, 23 per cent of Australian funds use the quarantine level of protection and 27 per cent use the monitor level.
“The recent breach resulting in over $500,000 in losses demonstrates these threats aren’t theoretical and, in fact, regular occurrences growing in volume. They’re actively impacting Australians’ retirement savings,” Moros said.
“While resource constraints are understandable, implementing robust DMARC protection isn’t optional in today’s threat landscape – it’s essential infrastructure that stands between members’ life savings, their privacy and increasingly sophisticated fraud campaigns targeting these critical financial institutions.”
The analysis was conducted based on a list of APRA-regulated super funds in April this year.
Earlier this month, speaking at Momentum Media’s Election 2025 breakfast event in Sydney, Mary Delahunty, CEO of the Association of Superannuation Funds of Australia (ASFA), took a moment to address the cyber incident that gripped some Australian super funds last week.
Initially, the funds affected by the incident included Rest, Hostplus, AustralianSuper, Insignia’s Expand platform, and Australian Retirement Trust, followed later by Cbus Super and Media Super, which raised alarms after a surge of suspicious login attempts.
“I’m sure all of you are aware of the cyber incident that affected several superannuation funds recently. It’s now being investigated by police and government authorities,” Delahunty said.
“While I can’t say a lot at the moment, I can say that the cyber criminals undertook a coordinated, well-funded and sophisticated attack on our system.
“The superannuation sector is taking this extremely seriously, as we should.”
Delahunty said at the time that reviews are underway to assess where further protections are needed.
Recommended for you
The super fund announced that Gregory has been appointed to its executive leadership team, taking on the fresh role of chief advice officer.
The deputy governor has warned that, as super funds’ overseas assets grow and liquidity risks rise, they will need to expand their FX hedge books to manage currency exposure effectively.
Super funds have built on early financial year momentum, as growth funds deliver strong results driven by equities and resilient bonds.
The super fund has announced that Mark Rider will step down from his position of chief investment officer (CIO) after deciding to “semi-retire” from full-time work.
TOP PERFORMING FUNDS
ACS FIXED INT - AUSTRALIA/GLOBAL BOND
Fund name
3y(%)pa
1
DomaCom DFS Mortgage
76.97 3 y p.a(%)
2
Global X 21Shares Bitcoin ETF
76.46 3 y p.a(%)
3
UBS Solactive Global Pure Gold Miners UCITS ETF Dis USD
51.13 3 y p.a(%)
4
Global X GlobalX FANG+ ETF
45.15 3 y p.a(%)
5
Select Baker steel Gold Institutional
43.78 3 y p.a(%)
